// c0mrade

// 6-13-12

 

Hello, world.

 

I'm officially a white-hat. 

 

Major Airlines are affected by a major exploit. Among those affected include:

 

American Airlines

United Airlines

Vietnam Airlines

Sabre Airlines

 

Here's what I have access to:

 

=>Internal Access to both airports.

=>Booking Flights, Ticketing Info, Hotel Booking, etc.

=>Card Swaps.

=>Employee Info, etc

=>Flight Info, Passenger info, etc.

=>Multiple vulnerabilities among the software they're running.

 

The vulnerability was simple. Amongst those vulnerable, all were exploited. How did I do this? Simple:

 

=> We found an exploit which enabled the right for us to download all the attachments on the site.

=> Amongst the things we found was an Application system used for the Airports.

=> We tested the software for vulnerabilities.

=> Pew! We got past the Employee-Log in.

 

Furthermore, the piece of software was mildly outdated. I setup a file to pull any file it can get to. I got some coffee and came back. It pulled tons of information. I found this important to an extent as nobody else has ever been there.

 

Picture 1:

 

http://i50.tinypic.com/ev73fs.png

 

Picture 2:

 

http://i47.tinypic.com/ofo5rp.png

 

Picture 3:

 

http://i48.tinypic.com/ibicmv.png

 

I couldn't do much in the beginning as everything was local. I then got access to a configuration system which mildly accepted the file type, ".properties" - I found around four files pertaining to it, these being: editor.properties, pm.properties, qik.properties, and taconfig.properties. I had the ability to switch the key system from !local to !remote. Meaning, I could have logged card swaps, passenger info, and much, much more.

 

Insight:

 

Protocol: DNS

=> hsspconfig.sabre.com

=> ACCESS.SABRE.COM

=======================

!  151.193.141.254:54483

!  American Airlines (h00lyshit)

!  taconfig.key = XSTBCKA001

=======================

Host Name - sabre:hssup:uii_host

Line IATA: 000000

Pool Name: VNOCCNBA

=======================

 

This will be getting reported to all major airlines very soon. I'm just addressing the public first so they know what happened.